thac0/vim
1
0
Fork 0
forked from aniani/vim
Code Activity

patch 8.2.3427: double free when list is copied

Browse Source 
Problem:    Double free when list is copied.
Solution:   Allocate the type when making a copy. (closes #8862)
            Clear the type for flattennew().  Avoid a memory leak when
            flattennew() fails.
This commit is contained in:
Bram Moolenaar
2021-09-11 20:20:38 +02:00
parent 4b4b1b84ee
commit b3bf33a7b2
3 changed files with 19 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
src/list.c
View File

@@ -952,7 +952,10 @@ list_flatten(list_T *list, long maxdepth)
vimlist_remove(list, item, item);
if (list_extend(list, item->li_tv.vval.v_list, next) == FAIL)
{
list_free_item(list, item);
return;
}
clear_tv(&item->li_tv);
tofree = item;
@@ -1023,6 +1026,9 @@ flatten_common(typval_T *argvars, typval_T *rettv, int make_copy)
rettv->vval.v_list = l;
if (l == NULL)
return;
// The type will change.
free_type(l->lv_type);
l->lv_type = NULL;
}
else
{
@@ -1217,7 +1223,7 @@ list_copy(list_T *orig, int deep, int copyID)
copy = list_alloc();
if (copy != NULL)
{
copy->lv_type = orig->lv_type;
copy->lv_type = alloc_type(orig->lv_type);
if (copyID != 0)
{
// Do this before adding the items, because one of the items may